Book

Description

Copyright 2006

Dimensions: 7-3/8" x 9-1/4"

Pages: 480

Edition: 1st

Book

ISBN-10: 0-321-24544-X

ISBN-13: 978-0-321-24544-1

Virtual private networks (VPNs) based on the Internet instead of the traditional leased lines offer organizations of all sizes the promise of a low-cost, secure electronic network. However, using the Internet to carry sensitive information can present serious privacy and security problems. By explaining how VPNs actually work, networking expert Jon Snader shows software engineers and network administrators how to use tunneling, authentication, and encryption to create safe, effective VPNs for any environment.

Using an example-driven approach, VPNs Illustrated explores how tunnels and VPNs function by observing their behavior "on the wire." By learning to read and interpret various network traces, such as those produced by tcpdump, readers will be able to better understand and troubleshoot VPN and network behavior.

Specific topics covered include:

Block and stream symmetric ciphers, such as AES and RC4; and asymmetric ciphers, such as RSA and EIGamal

Message authentication codes, including HMACs

Tunneling technologies based on gtunnel

SSL protocol for building network-to-network VPNs

SSH protocols as drop-in replacements for telnet, ftp, and the BSD r-commands

Packed with details, the text can be used as a handbook describing the functions of the protocols and the message formats that they use. Source code is available for download, and an appendix covers publicly available software that can be used to build tunnels and analyze traffic flow.

VPNs Illustrated gives you the knowledge of tunneling and VPN technology you need to understand existing VPN implementations and successfully create your own.

Appendix A Source Code 419

Appendix B Miscellaneous Software 425

B.1 Netcat 425

B.2 tcpdump and Other Packet Sniffers 426

B.3 ssldump 429

B.4 PPP 431

Bibliography 435

Index 445

Preface

Untitled Document
Introduction
There is a revolution going on in enterprise networking. Until very recently,
enterprises that needed to link computers in geographically dispersed locations
had to build their own wide area networks (WANs). Usually this meant renting expensive
and, by today's Internet standard, relatively slow frame relay circuits. A typical
56 Kb/s circuit could cost several hundred, or even over a thousand, dollars a
month.

Today, the typical home computer user enjoys a broadband Internet connection
having a 5 Mb/s download speed for a cost of about $40 per month. Commercial
variants of this service, offering higher speeds and other amenities, are available
for between $100 and $200 per month. Obviously, this significant increase in
speed and decrease in cost represent a tremendous opportunity for enterprises,
but they do introduce new problems.

The Internet is an open environment and, compared to leased lines, dreadfully
insecure. Increases in bandwidth and decreases in cost are worthless if they
mean that an enterprise's vital data can be intercepted by competitors, or that
financial transactions are subject to manipulation by outsiders. This book discusses
ways to overcome these problems by recreating the security of leased lines in
a public medium such as the Internet.

The fundamental mechanism that allows us to have secure communications in the
Internet is the notion of a tunnel. As we'll see, tunnels are a way of overlaying
a logical or virtual network on top of a physical network. Once we have such
a tunnel, we can secure it by encrypting and authenticating the network traffic
that flows through it, thus recreating the security of private leased lines.

Of course, this simple description hides a substantial set of details and problems.
We'll see that it's actually quite difficult to endow such tunnels with robust
security. Much of the book is concerned with exploring solutions to these problems,and
seeing why the successful solutions work and where the unsuccessful ones fail.

Source Code and Errata Availability
Source code discussed in the text and other supporting material are available
on my Web site athttp://home.netcom.com/~jsnader. The networking libraries and
skeletons from Effective TCP/IPProgramming, which I mention and use occasionally
in the text, are also available on the Web site.

My readers, it turns out, are much better at finding mistakes than I am. Although
I go over the text carefully, checking that every i is dotted and every t crossed,
errors still manage to evade me. Fortunately, most of these are caught by the
careful and fastidious professionals at Addison-Wesley. Still, some errors will
no doubt escape into the final published text. As these are discovered--usually
by careful readers--I add them to an errata list for the book. This list is
always available at my Web site.

Colophon
As with my previous book, I produced camera-ready copy for this text using James
Clark's splendid Groff typesetting suite (now maintained by Ted Harding and Werner
Lemberg) and Rich Stevens' modified ms macros.I used the gpic, gtbl, and geqn
preprocessors for the figures, tables, and mathematical notation, respectively.
Some of the figures use gpic macros from Rich Stevens and Gary Wright. Indexing
tools from Jon Bentley and Brian Kernighan were a huge help in the production
of the index. I included the source code for the programming examples directly
from their source files with Dave Hanson's loom utility. The text is set in the
Palatino typeface.

As always, I welcome readers' comments, suggestions, and corrections. Please
feel free to email me at the address below.